x402 List Submit a serviceSubmit
Menu

RelayShield

payment-readyonline

payment-ready until 2026-10-18

Threat intelligence and identity-risk API: breach exposure, infostealer log detection, SIM-swap and session-hijack checks, ransomware victim lookup, and AI-agent-specific security checks (malicious MCP server detection, prompt-injection breach detection). 24 endpoints, all indexed in the Coinbase CDP Bazaar.

relayshield.net ↗

Call it x402 v1

x402 v1

Base URL
https://api.relayshield.net
Payment
x402 v1, header channel
$ curl -i -X POST 'https://api.relayshield.net/v1/payg/breach'

An unpaid request returns HTTP 402 with the payment terms. Sign a payment authorization, then retry with the X-PAYMENT header.

Endpoints 10 paid routes on api.relayshield.net

POST/v1/payg/breachBase+Sol$0.10since 07-13
POST/v1/payg/bulk-identity-riskBase+Sol$2.00since 07-13
POST/v1/payg/domainBase+Sol$0.50since 07-13
POST/v1/payg/identity-risk-scoreBase+Sol$0.35since 07-13
POST/v1/payg/infostealerBase+Sol$0.15since 07-13
POST/v1/payg/mcp-registry-riskBase+Sol$0.35since 07-13
POST/v1/payg/prompt-injection-breachBase+Sol$0.35since 07-13
POST/v1/payg/ransomware-riskBase+Sol$0.40since 07-13

2 more in Example 402 response

Prices as captured in the 402 response: median $0.35 across the 10 endpoints.

Example 402 response

Endpoints and prices

Current paid endpoints; minimum quoted prices in USD where available; first capture dates in UTC
MethodPathDescriptionPriceNetworkAsset402 channelCaptured
POST/v1/payg/breachRelayShield breach check$0.10Base+SolUSDCheadersince 07-13
POST/v1/payg/bulk-identity-riskRelayShield bulk identity risk check$2.00Base+SolUSDCheadersince 07-13
POST/v1/payg/domainRelayShield domain check$0.50Base+SolUSDCheadersince 07-13
POST/v1/payg/identity-risk-scoreRelayShield identity risk score check$0.35Base+SolUSDCheadersince 07-13
POST/v1/payg/infostealerRelayShield infostealer check$0.15Base+SolUSDCheadersince 07-13
POST/v1/payg/mcp-registry-riskRelayShield mcp registry risk check$0.35Base+SolUSDCheadersince 07-13
POST/v1/payg/prompt-injection-breachRelayShield prompt injection breach check$0.35Base+SolUSDCheadersince 07-13
POST/v1/payg/ransomware-riskRelayShield ransomware risk check$0.40Base+SolUSDCheadersince 07-13
POST/v1/payg/sim-swapRelayShield sim swap check$0.25Base+SolUSDCheadersince 07-13
POST/v1/payg/tech-stack-cveRelayShield tech stack cve check$0.20Base+SolUSDCheadersince 07-13

Payment evidence

402 payload captured at . Check evidence JSON · Measurement methodology.

First of 10 payloads captured by the monitor.

94 lines, scroll inside

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/breach",
      "description": "RelayShield breach check",
      "outputSchema": {
        "input": {
          "body": {
            "email": "[email protected]"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "email": "[email protected]",
            "breaches": [
              {
                "name": "ExampleBreach",
                "domain": "example.com",
                "breach_date": "2023-06-01",
                "is_verified": true,
                "data_classes": [
                  "Passwords",
                  "Email addresses"
                ]
              }
            ],
            "breach_count": 3
          }
        }
      },
      "maxAmountRequired": "100000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/breach",
      "description": "RelayShield breach check",
      "outputSchema": {
        "input": {
          "body": {
            "email": "[email protected]"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "email": "[email protected]",
            "breaches": [
              {
                "name": "ExampleBreach",
                "domain": "example.com",
                "breach_date": "2023-06-01",
                "is_verified": true,
                "data_classes": [
                  "Passwords",
                  "Email addresses"
                ]
              }
            ],
            "breach_count": 3
          }
        }
      },
      "maxAmountRequired": "100000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}
Other captured 402 responses (9)

Captured payload 2 of 10

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/domain",
      "description": "RelayShield domain check",
      "outputSchema": {
        "input": {
          "body": {
            "domain": "acme.com"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "domain": "acme.com",
            "checked_at": "2026-05-19T10:00:00+00:00",
            "lookalikes": [
              {
                "domain": "acrne.com"
              },
              {
                "domain": "acme-login.com"
              }
            ],
            "lookalikes_found": 2,
            "candidates_checked": 30
          }
        }
      },
      "maxAmountRequired": "500000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/domain",
      "description": "RelayShield domain check",
      "outputSchema": {
        "input": {
          "body": {
            "domain": "acme.com"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "domain": "acme.com",
            "checked_at": "2026-05-19T10:00:00+00:00",
            "lookalikes": [
              {
                "domain": "acrne.com"
              },
              {
                "domain": "acme-login.com"
              }
            ],
            "lookalikes_found": 2,
            "candidates_checked": 30
          }
        }
      },
      "maxAmountRequired": "500000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}

Captured payload 3 of 10

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/infostealer",
      "description": "RelayShield infostealer check",
      "outputSchema": {
        "input": {
          "body": {
            "email": "[email protected]"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "email": "[email protected]",
            "found": false,
            "stealers": [],
            "stealer_count": 0
          }
        }
      },
      "maxAmountRequired": "150000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/infostealer",
      "description": "RelayShield infostealer check",
      "outputSchema": {
        "input": {
          "body": {
            "email": "[email protected]"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "email": "[email protected]",
            "found": false,
            "stealers": [],
            "stealer_count": 0
          }
        }
      },
      "maxAmountRequired": "150000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}

Captured payload 4 of 10

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/ransomware-risk",
      "description": "RelayShield ransomware risk check",
      "outputSchema": {
        "input": {
          "body": {
            "domain": "acme.com"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "domain": "acme.com",
            "on_victim_list": false,
            "pre_ransomware_credential_count": 0
          }
        }
      },
      "maxAmountRequired": "400000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/ransomware-risk",
      "description": "RelayShield ransomware risk check",
      "outputSchema": {
        "input": {
          "body": {
            "domain": "acme.com"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "domain": "acme.com",
            "on_victim_list": false,
            "pre_ransomware_credential_count": 0
          }
        }
      },
      "maxAmountRequired": "400000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}

Captured payload 5 of 10

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/identity-risk-score",
      "description": "RelayShield identity risk score check",
      "outputSchema": {
        "input": {
          "body": {
            "domain": "acme.com"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "grade": "A",
            "domain": "acme.com",
            "summary": "Domain acme.com scores 10/100 (A — LOW) across 2 of 6 monitored identity signal dimensions.",
            "max_score": 100,
            "risk_level": "LOW",
            "risk_score": 10,
            "risk_factors": [
              "Breach exposure: 1 known breach event(s), 50,000 accounts affected"
            ],
            "dimension_scores": {
              "cve_exposure": 5,
              "breach_exposure": 5,
              "session_exposure": 0,
              "infostealer_density": 0,
              "ransomware_exposure": 0,
              "threat_actor_targeting": 0
            }
          }
        }
      },
      "maxAmountRequired": "350000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/identity-risk-score",
      "description": "RelayShield identity risk score check",
      "outputSchema": {
        "input": {
          "body": {
            "domain": "acme.com"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "grade": "A",
            "domain": "acme.com",
            "summary": "Domain acme.com scores 10/100 (A — LOW) across 2 of 6 monitored identity signal dimensions.",
            "max_score": 100,
            "risk_level": "LOW",
            "risk_score": 10,
            "risk_factors": [
              "Breach exposure: 1 known breach event(s), 50,000 accounts affected"
            ],
            "dimension_scores": {
              "cve_exposure": 5,
              "breach_exposure": 5,
              "session_exposure": 0,
              "infostealer_density": 0,
              "ransomware_exposure": 0,
              "threat_actor_targeting": 0
            }
          }
        }
      },
      "maxAmountRequired": "350000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}

Captured payload 6 of 10

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/mcp-registry-risk",
      "description": "RelayShield mcp registry risk check",
      "outputSchema": {
        "input": {
          "body": {
            "server_url": "https://example-mcp-server.com"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "verdict": "LOW",
            "findings": []
          }
        }
      },
      "maxAmountRequired": "350000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/mcp-registry-risk",
      "description": "RelayShield mcp registry risk check",
      "outputSchema": {
        "input": {
          "body": {
            "server_url": "https://example-mcp-server.com"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "verdict": "LOW",
            "findings": []
          }
        }
      },
      "maxAmountRequired": "350000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}

Captured payload 7 of 10

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/tech-stack-cve",
      "description": "RelayShield tech stack cve check",
      "outputSchema": {
        "input": {
          "body": {
            "tech_stack": [
              "nginx",
              "wordpress",
              "cisco ios"
            ]
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "matched_cves": [],
            "critical_count": 0,
            "tech_stack_queried": [
              "nginx"
            ]
          }
        }
      },
      "maxAmountRequired": "200000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/tech-stack-cve",
      "description": "RelayShield tech stack cve check",
      "outputSchema": {
        "input": {
          "body": {
            "tech_stack": [
              "nginx",
              "wordpress",
              "cisco ios"
            ]
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "matched_cves": [],
            "critical_count": 0,
            "tech_stack_queried": [
              "nginx"
            ]
          }
        }
      },
      "maxAmountRequired": "200000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}

Captured payload 8 of 10

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/bulk-identity-risk",
      "description": "RelayShield bulk identity risk check",
      "outputSchema": {
        "input": {
          "body": {
            "targets": [
              {
                "agents": [
                  "[email protected]"
                ],
                "domain": "acme.com"
              }
            ]
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "queried": 1,
            "results": [
              {
                "domain": "acme.com",
                "agent_count": 1,
                "domain_grade": "A",
                "domain_score": 10
              }
            ],
            "high_count": 0,
            "critical_count": 0
          }
        }
      },
      "maxAmountRequired": "2000000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/bulk-identity-risk",
      "description": "RelayShield bulk identity risk check",
      "outputSchema": {
        "input": {
          "body": {
            "targets": [
              {
                "agents": [
                  "[email protected]"
                ],
                "domain": "acme.com"
              }
            ]
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "queried": 1,
            "results": [
              {
                "domain": "acme.com",
                "agent_count": 1,
                "domain_grade": "A",
                "domain_score": 10
              }
            ],
            "high_count": 0,
            "critical_count": 0
          }
        }
      },
      "maxAmountRequired": "2000000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}

Captured payload 9 of 10

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/prompt-injection-breach",
      "description": "RelayShield prompt injection breach check",
      "outputSchema": {
        "input": {
          "body": {
            "email": "[email protected]"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "found": false,
            "session_count": 0
          }
        }
      },
      "maxAmountRequired": "350000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/prompt-injection-breach",
      "description": "RelayShield prompt injection breach check",
      "outputSchema": {
        "input": {
          "body": {
            "email": "[email protected]"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "found": false,
            "session_count": 0
          }
        }
      },
      "maxAmountRequired": "350000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}

Captured payload 10 of 10

{
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x002CfD89c5636F45E3C8576D6E35154748412bAc",
      "scheme": "exact",
      "network": "base",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/sim-swap",
      "description": "RelayShield sim swap check",
      "outputSchema": {
        "input": {
          "body": {
            "phone": "+14155551234"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "phone": "+14155551234",
            "carrier": "T-Mobile",
            "swapped": true,
            "checked_at": "2026-05-19T10:00:00+00:00",
            "swap_timestamp": "2026-05-18T14:23:00Z"
          }
        }
      },
      "maxAmountRequired": "250000",
      "maxTimeoutSeconds": 300
    },
    {
      "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
      "extra": {
        "feePayer": "EwWqGE4ZFKLofuestmU4LDdK7XM1N4ALgdZccwYugwGd"
      },
      "payTo": "E64PiTT7U8ZUWFKdkrBFw1YzdD2bU1gKcuGnBRVqp7M6",
      "scheme": "exact",
      "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
      "mimeType": "application/json",
      "resource": "https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/sim-swap",
      "description": "RelayShield sim swap check",
      "outputSchema": {
        "input": {
          "body": {
            "phone": "+14155551234"
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json",
          "discoverable": true
        },
        "output": {
          "ok": true,
          "data": {
            "phone": "+14155551234",
            "carrier": "T-Mobile",
            "swapped": true,
            "checked_at": "2026-05-19T10:00:00+00:00",
            "swap_timestamp": "2026-05-18T14:23:00Z"
          }
        }
      },
      "maxAmountRequired": "250000",
      "maxTimeoutSeconds": 60
    }
  ],
  "x402Version": 1
}

Can I trust it score from our own monitoring

score from our own monitoring

80/100 Solid

#257 of 363 in Data. Bands: strong 93+, solid 75+, mixed 55+, weak below 55.

Reliability
100% uptime 30d
Compliance
A 13/14 checks pass, failing: declares the current x402 version (2)
Price
$0.10 to $2.00 p93 in Data
Risk
clean no risk flag
Traction
$0.15 30d 2 buyers, top buyer 66% (address, not entity)
13/14 compliance checks
  • 402 payload captured
  • accepts[] array present
  • payTo address recoverable
  • payTo at accepts[0].payTo (conformant shape)
  • payTo is a valid on-chain address
  • atomic price declared
  • atomic price in a sane range
  • asset (token) address declared
  • network resolves to CAIP-2
  • payment scheme declared
  • served over HTTPS
  • declares the current x402 version (2)
  • EIP-712 domain parameters present on every EVM entry
  • x402 v2 envelope delivered in the payment-required header

402 terms unchanged since 2026-07-13. Last up 2026-10-11.

── Site signals

  • homepage reachable
  • openapi doc
  • pricing page
  • llms.txt
  • robots.txt
  • terms page
How the score works

What the score read on this service: status online, 100% uptime 30d, 489ms response p95, x402 compliance 13 of 14, $0.1 price against the category, on-chain traction measured. Each of those is measured, and each is published in full below.

The score comes from our own monitoring, never from reviews, operator claims, or a language model: reliability, x402 compliance, price against the category, a deterministic risk flag, and a small on-chain traction term, weighted by ranking generation 3. It is not placement anyone can buy: the paid verify tier is reported beside it and is not one of its inputs. Every component below stays published and read-only.

Bands on the 0 to 100 measured score: strong at 93 and above, solid from 75, mixed from 55, weak below 55. Price and speed are scored against the whole category field, every listing in it that carries no danger flag, the scored service included, so the score places a service in its own field.

It is a score inside Data, and only there: price and speed are scored against the whole category field, every listing in it that carries no danger flag, the scored service included, which here means 363 listings, this one among them: the same 363 the position above is counted against. When the two differ, the field is the wider one, because a listing we have measured too little of to rank still sits in the field the price and the speed are normalized over. The same service in a different field would read differently. The same engine answers GET /api/v1/best, and asked for a different pool (the whole directory, or another filter) it returns a different number for this service under this same ranking generation. Neither is more correct: they answer different questions, and the methodology states which is which.

Settled via coinbase ($0.15, 2 tx). Traction is a conservative undercount; first settlement seen 2026-07-11.

All measured facts

What it does

Threat intelligence and identity-risk API: breach exposure, infostealer log detection, SIM-swap and session-hijack checks, ransomware victim lookup, and AI-agent-specific security checks (malicious MCP server detection, prompt-injection breach detection). 24 endpoints, all indexed in the Coinbase CDP Bazaar.

RelayShield is a listed x402 Data API. Captured payment terms name Base, Solana. Monitoring and settlement figures below describe the observations available to this directory; an unpaid HTTP 402 check does not prove that a paid call will deliver.

Assessment computed at . Latest service check observed at . Service data JSON · Measurement methodology.

Page rendered at . This response time is separate from the observation and computation times attached to each measurement.

Latest endpoint observation: . Latest price capture: . Prices are recorded quotes, not a promise of availability. Token assets and payment terms are listed separately. Endpoint data JSON · Price history JSON · Measurement methodology.

Assessment computed at . Uptime uses the stated daily-rollup window; response times are in milliseconds, compliance is passed/evaluated checks, and traction is a measured settlement floor. The comparison score is out of 100 within this category. Assessment JSON · Measurement methodology.

Observed daily coverage: 2026-09-12 to 2026-10-11 UTC. Daily monitoring and settlement rollups do not expose their computation time; a bucket date is not an update timestamp. Latest settlement in the assessment: . Uptime and response JSON · Volume JSON · Buyers JSON · Measurement methodology.

Ranked from the measured category pool, refreshed at most once a minute. The comparison has no persisted computation timestamp; the assessment time above belongs to this service only. Ranking API documentation · Ranking methodology.

x402 List home · Services · Data

uptime · latest daily rollup
100%
uptime 7d
99.8%
uptime 30d
100%
uptime 90d
100%
response p95
489ms
avg response
238ms
total checks
2,766

Measured on the unpaid 402 handshake, not the paid call. A service can 402 correctly and still fail after payment.

price (min)
$0.10
price (max)
$2.00
category percentile (min)
p93 in Data
category percentile (max)
p94 in Data
endpoints / prices
10 / 8
model
tiered
stability
100%

No deterministic risk flag. Risk fires only on an exact blocklist match, or a reserved-brand name with a mismatched verified payTo. Never from low uptime, a high price, or a model guess.

domain age
-
registrar
-
hosting
custom
domain created
---

Identity facts, not a risk score.

assessment volume 30d
$0.15
exact assessment volume 30d (USD)
0.15
assessment recorded at (UTC)
2026-10-11T21:13:02.460Z
buyers 30d
2
settlements 30d
2
measured since
2026-07-11 (start of our harvest window)
last settlement
2026-09-24
top buyer share
66% of 30d volume (address, not entity)
top 3 buyers share
100% of 30d volume (addresses, not entities)
concentrated volume
no
trend 7d vs 30d
0.00x the 30d daily rate
networks
eip155:8453, solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d
volume all-time
$53.40
settlements all-time
134
median settlement 30d
$0.075
max settlement 30d
$0.10

Assessment volume uses the latest 30d assessment. Over time sums daily address snapshots, rounded to cents and refreshed separately. The two sources can differ in timing, precision and shared-address attribution. Amounts use cents for comparison; known sub-cent values keep up to 12 significant digits. The exact stored assessment value is shown above.

Conservative undercount: only USDC settlements via facilitators we measure are counted. A measured floor, not an estimate.

Top buyer share lowers the on-chain traction part of the ranking score behind this page's verdict and /best, by up to half when one address holds all 30d volume. The Recommended and Highest volume sorts of the services list do not use it; they use the Concentrated volume rule instead.

member since
2026-07-13
Recent checks
Latest 18 unpaid HTTP checks, newest first; response times in milliseconds, observation times in UTC
Checked at (UTC)StatusHTTPResponseEndpoints
Online402345ms10
Online402231ms10
Online402343ms10
Online402304ms10
Online402183ms10
Online402445ms2
Online402548ms2
Online402353ms2
Online402436ms2
Online402456ms2
Online402435ms2
Online402408ms2
Online402468ms2
Online402408ms2
Online402395ms2
Online402413ms2
Online402447ms2
Online402577ms2

Changes0 in 30d

No changes recorded in the last 30 days.

all changes

Over time

On-chain volume daily snapshots, USD 30d: $0.15, peak $0.10 on 09-24
volume no data in the payload
Distinct buyers per dayDistinct buyers per day
Uptime 1 of 29 completed days below 100%
uptime below 100%, to scale
Volume 30d
$0.15
Uptime
1 of 29 completed days below 100%
Daily on-chain settlement volume in US dollars, 2026-09-12 to 2026-10-11; highest day $0.10 on 09-24; 28 days have no data in the payload; distinct buyers per day
More charts
Response time daily average, ms min 138ms, avg 240ms, max 418ms

09-12 to 10-11* UTC

Scores over time

x402 compliance low 13/14, high 13/14

09-12 to 10-11* UTC

Price percentile in Data own low to high; exact values below

09-12 to 10-11* UTC

Site signals present (of 6) own low to high; exact values below

09-12 to 10-11* UTC

Scores: one day per column, 09-12 to 10-11*, on the columns of Response time. Uptime held below 100% on some days in this window, including any partial day. Daily readings remain in the Uptime strip and Values. The checklist grew from 11 to 14 checks on 2026-07-28, before this window. Pillar lines use their own low and high. Exact dated readings are available in each readout and in Values.

Each series spans only the dates it has data for. Every series is also served as JSON at /api/v1/services/relayshield/price, /scores, /volume and /buyers.

Values

* today so far, partial (UTC).

The uptime summary counts completed UTC days only. The strip, readouts and table retain today's partial reading.

Daily snapshot total, 30d: $0.15, peak $0.10 on 09-24. The visible 30d total in Traction comes from the latest assessment. These sources can differ in their window, refresh time, cent rounding and shared-address attribution.

Daily address snapshots: 2026-09-12 to 2026-10-11 UTC; * today so far, partial (UTC). Daily snapshots store cents. A recorded $0.00 with settlements cannot distinguish exact zero from volume rounded away. Lost precision is unavailable here.

Settlement volume uses the stored USD valuation of tracked payments; it is distinct from token quantities. USD-pegged assets are valued at 1 USD per token in these rollups. The measured settlement floor does not cover all payments to this service.

Assessment history last recorded at . Each UTC day uses its last recorded run; missing readings stay unmeasured. Assessment history JSON · Measurement methodology.

Daily values, 2026-09-12 to 2026-10-11: address settlement volume in USD, distinct buyer and settlement counts, uptime percent, average response milliseconds, compliance passed/total, price percentile 0-100, site signals out of 6; UTC dates
DayVolumeBuyersSettlementsUptimeResponseCompliancePrice percentileSite signals
2026-09-12no datano datano data100%256.32ms13/14p924/6
2026-09-13no datano datano data100%200.82ms13/14p924/6
2026-09-14no datano datano data100%189.84ms13/14p924/6
2026-09-15no datano datano data100%173.34ms13/14p924/6
2026-09-16no datano datano data100%228.76ms13/14p924/6
2026-09-17$0.0511100%147.28ms13/14p924/6
2026-09-18no datano datano data100%138.12ms13/14p924/6
2026-09-19no datano datano data100%154.91ms13/14p924/6
2026-09-20no datano datano data100%181.72ms13/14p924/6
2026-09-21no datano datano data100%193.37ms13/14p934/6
2026-09-22no datano datano data100%229.20ms13/14p934/6
2026-09-23no datano datano data100%230.88ms13/14p924/6
2026-09-24$0.1011100%284.16ms13/14p924/6
2026-09-25no datano datano data100%275.83ms13/14p924/6
2026-09-26no datano datano data100%294.38ms13/14p924/6
2026-09-27no datano datano data100%265.28ms13/14p924/6
2026-09-28no datano datano data100%253.72ms13/14p924/6
2026-09-29no datano datano data100%252.36ms13/14p924/6
2026-09-30no datano datano data100%274.74ms13/14p924/6
2026-10-01no datano datano data100%262.58ms13/14p924/6
2026-10-02no datano datano data100%282.10ms13/14p924/6
2026-10-03no datano datano data100%245.83ms13/14p924/6
2026-10-04no datano datano data100%230.58ms13/14p934/6
2026-10-05no datano datano data100%363.51ms13/14p934/6
2026-10-06no datano datano data100%141.40ms13/14p934/6
2026-10-07no datano datano data100%219.57ms13/14p934/6
2026-10-08no datano datano data98.89%309.18ms13/14p934/6
2026-10-09no datano datano data100%213.13ms13/14p934/6
2026-10-10no datano datano data100%277.24ms13/14p934/6
2026-10-11*no datano datano data100%417.86ms13/14p934/6

Alternatives in Data

SniperX•x402 strong 97/100 99.9% up 30d $410.42 30d
claw402 strong 96/100 100% up 30d $947.47 30d
glim.sh strong 94/100 100% up 30d $24.28 30d
cn402 strong 94/100 100% up 30d $40.50 30d
x402node strong 93/100 99.9% up 30d $40.50 30d

5 of 362 other ranked services in Data, ordered by the same measured score.

see the whole category

Own this service?

Keep this listing accurate. Ownership is proven with a domain check and every change is reviewed by hand.

Update this listing

Earn the verified tier: x402list pays a real call to this endpoint and, if it delivers, the service is delivery-verified. The fee covers the cost of the probe, not the badge; there is no refund if the call does not deliver. Agent and API only, no in-browser signing. See /api.

Verify this service ($0.25)
Embed a badge

HTML

<a href="https://x402-list.com/services/relayshield?utm_source=badge&utm_medium=referral&utm_campaign=embed">
  <img src="https://x402-list.com/badge/relayshield.svg" alt="RelayShield listed on x402-list" height="28">
</a>

Markdown

[![RelayShield on x402-list](https://x402-list.com/badge/relayshield.svg)](https://x402-list.com/services/relayshield?utm_source=badge&utm_medium=referral&utm_campaign=embed)

HTML, live uptime variant

<a href="https://x402-list.com/services/relayshield?utm_source=badge&utm_medium=referral&utm_campaign=embed">
  <img src="https://x402-list.com/badge/relayshield.svg?data=uptime" alt="RelayShield uptime on x402-list" height="28">
</a>
Delisting

To request delisting, email info@x402-list.com or update your listing at /services/relayshield/update.